2566f907ad488448246b81cce80809582826682aa0a1591610c4778643cf6259

Analysis

max time kernel
121s
max time network
128s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12/10/2024, 15:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3ab3f71dc8ce5d9b519d1b89328f055d_JaffaCakes118.html
Size

2KB
MD5

3ab3f71dc8ce5d9b519d1b89328f055d
SHA1

3e41bf96ff374fe9c23b2d4ee4abc3efc6ece0d8
SHA256

2566f907ad488448246b81cce80809582826682aa0a1591610c4778643cf6259
SHA512

6dfbd102d0c70ea9d16a603267fd1f0b1587961f0c35bce76928e3fbb92a2f644904fa848994b7a358b128a6f294df0ad8e16ba24e4ba16878644c941f6fb246

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b8d48fc8adfa6b4a805f1a4a681aaa6f000000000200000000001066000000010000200000003a79b071ea42cc4e98541d9f93f0bf3a74adc703ff7a9b085238a75d02e1ffc9000000000e80000000020000200000000a9f2a33f2b9d57e7d3f1ab89212c05a5b5d0d511b70e905fb5465d8cf46e21590000000c3ef10509c420fbedd3d58124ab980234cb38360ccce95abb6f79dacd861c5792d8504ed6a2092e141679268183c89b9dc6d9acb85245c9b5c52d96a8e8c5f025b19e01510467c95624282d87ae9ab76e56e018d303f12e71cf0f1818bd272d8b2c0d76e7443f71c57b6e903b495a0f3201667b9c1f310ad09ab5997d99a856d39d213866ec06f9d351dbbf8b9e7ccaf40000000c8fbc7c55b5ad5eb008ebd986f6ebf25b2ac601da8a0e743ee331ecfc962dae38933c35b9be478f5edddbb4b1d3933344629991cc9c46e928eabdf3eb68e44d0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 1063c366b91cdb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{92526301-88AC-11EF-AA6E-5A85C185DB3E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b8d48fc8adfa6b4a805f1a4a681aaa6f00000000020000000000106600000001000020000000baf47307078c7d9f8a2b2d6f8238900a02df3b6cf7e4c92cd5cf3cd6bf92dbb4000000000e80000000020000200000001b6f3825837fb946ad5e2dcf32d38cf95ad1ee06793a5f25b903fb0ca6fabd47200000000f3cada189f34cc1967ee8e5f0b35b919d86d7aab7a03f2ab69e56211d5dc51240000000ae35b4f97a3038cac392c07e6411c56b9edfd77a49f470002129068d3c7fed1270c641e85b7947ef1ee2e22844f944a4ec078cdbb4d23ef548296e4b1e870ded	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434907892"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2160	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2160	iexplore.exe
2160	iexplore.exe
2528	IEXPLORE.EXE
2528	IEXPLORE.EXE
2528	IEXPLORE.EXE
2528	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2160 wrote to memory of 2528	2160	iexplore.exe	30
PID 2160 wrote to memory of 2528	2160	iexplore.exe	30
PID 2160 wrote to memory of 2528	2160	iexplore.exe	30
PID 2160 wrote to memory of 2528	2160	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3ab3f71dc8ce5d9b519d1b89328f055d_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2160
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2160 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f67401e39159bb4db17b75507bee4663

SHA1
8f7dce5eddbe8afcf4d367df9ca8126058ece185

SHA256
9a30c8ddd5a102b5f08e0f0e76c36a0fa19b9b966a642fbfcf018a301fa6a68f

SHA512
3392ad78f405c9186752a267d7a2264f1b212c60eab6ccc7a2d56575cfc105bee4b33ea54be226579225889a74295f0f9978545851b9d1eae3c6bd464ad09775

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e59a770030e97591fe82ac3d7ca6b72d

SHA1
d5825027d8a8a28c9bc4beaa39b76dc4e4f189c6

SHA256
27fcb3d59ad800bf441a38c7efd54e08f4e6494c130802640aff05555e269f86

SHA512
81aade3cb755ecee608e1a8c9cb422ddeac630bf4f000b9ca92298cf920030fb1cc8c0be16f5bc52ebac17666acb0609902ecc11f57f738362efcc6b419abada

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fd6bb3d52d7affc3c8eb6ffd7af04ca6

SHA1
f14f029df02d8752adc58c40cba2cd1be02fdd8e

SHA256
cc58ec011dd7488bf7d5f193a9b67d87e404067a109d2c6a1486c54e7ee31c8f

SHA512
92932d122101e6313defc48891d8ce6be8caf72d4a40d58918f52c19ed893cc3bb58b9aa03152fd45326f5e1d8f24605f92f5befcc3ded5169ceb8c9dd603b8c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1c2719ee99bf7b5ad14e67c52add7c27

SHA1
be42528483826d81e74606d5ffda5bb4bcc7c39b

SHA256
397bf71b115710b16903e9e3bbcf786730f27722cd82480e725180730e63e597

SHA512
38ab9da1c80aab92ff780c0f5109a23f3fc81947577daa8e9efbdbae4d43207bbfa42ca830778bbf7d5bfa7d8172f67335d27afa4320f9ffcaca811f8ebcdc3e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dce2f731dccf1c82656699d13195e7e4

SHA1
047bb2d453731e0e9bbd5ad2bfe3d097fd69395b

SHA256
4251a82ebe11b30eef219eb487e4bc85902dacb3822e3be31f66dfa62b4dcacf

SHA512
3eccab920e6c3ccfa3725cdec786f0f18238470e00ab7949d3597c48409f1fbe36234068aa1320ecedd702812ef1f4a7781b5a2bd09b669216ee1db566c73bab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
143391d0019d222affc9e8feb2948674

SHA1
2a6c976da135f6512c9ef275f830bded0f071546

SHA256
f81fa60902cc31a7e81cfa4efa9742be56a31e718e60e30527374ccf8bd68e02

SHA512
075b73a910e0c5cf6121e68e796d991ed4875e100642d16a3d3b680077a0948f559567db8e1d035764d8d2880cce57931db9c7d2be92609a07e3d876eb44d94b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ab9a0426c263cb2a13c2eb7e7011d3c6

SHA1
48ef797e5227f35c97cd78ca08e129f045116c42

SHA256
882f663a133f5426a1f9ad63681550afbf313ffa5bc642e2fd4e567fe69e0edf

SHA512
a9a25d05ee9badc0266b4805e9e521aa973af3f156e0ae60a739e07712b121efcd877c29702d13a2d4bad038568b943f049f80b624c957073c77e6d02ccf26b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7173e797410bb8bfcb2cabda28494fef

SHA1
49fb5f1ae0d191906101205c3dcd53f2caf7e63b

SHA256
27a5c609119095978204e95540343f5af78d0a94a4df3feea0922f5b0fae0c3e

SHA512
a538269f06e3c684c37837077bfbb2d3744e5948e306bc3812ee359d24c87fe11e2d6696c006c66dcd0646df03ef8de4bb18d84a1f2a692a71fdb2454507eb0f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0dd4b3f53fa3b503a903971d4926d765

SHA1
a572fff4d1b64905ed9bba146d3b50c061fb6214

SHA256
7cf3f35ad72226c382e98fa29a768f2711a58fb0667fd584e55db8d0a990db2c

SHA512
a214dff850e076e6d61407b5af8244f45bc49922044da70f0d7b1f2e97424b2846d6ac5177bc4fb20c25b0e14cb884e66f511a973ce597bac2aeea6c490ff705

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
faf626c0a6d9e4ab62a2c4a848d1c325

SHA1
e8203050ea31c32f37f232f2b9e26f7f48b3a71d

SHA256
6981f549300c19f247f6001a1626d92e090e21beb1cb37988b55577ec3f39d10

SHA512
ffae08cdc8ec0823ab7736b6d9ddf8813d90ec78acff5905a2acb6015813c710e279d374696b4793b61640bc31c13dc81ce3883ca308fab335a253ec2acbec21

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabEADF.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarEB10.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit